2 ms·

> Example of the first: if your mail server uses the default-Windows-2016-TLS stack, Facebook's mail servers will immediately disconnect after issuing a STARTTL

by toast0 2y ago

> Example of the first: if your mail server uses the default-Windows-2016-TLS stack, Facebook's mail servers will immediately disconnect after issuing a STARTTLS command and receiving your server certificate. Why? No idea, everyone else seems to be fine, but this has been ongoing for years. Ok, nerd sniped. I can't likely get this fixed because I don't think I have any FB contacts for outbound mail, but I want to see a pcap and have a look at the TLS negotiation, if you provide the server hostname so I can run more starttls trials, that would also be neat. email in my profile. But yeah, good luck getting a response to big tech, I just want to know! In theory, facebook should have a postmaster that would look at email issues, but probably nobody looks at that address cause it's mostly junk.

toast0 2y ago
Oh yes, I forgot to tell you, facebook.com/whitehat is pretty good at escalating issues to the right team, but I don't know if someone would triage it and say it's not a security issue and then it has no urgency.
- antithesis-nl 2y ago
  > but I don't know if someone would triage it Well, I have a pretty good idea, and the answer won't comfort you. To further elaborate on this pointless saga: last December, I actually met a FB engineering executive while on holiday, happened to mention this issue in casual conversation (I know: sad!) and they were going to put me in touch with All The Right People who were going to Fix This Immediately. Guess what? The "oh, if the remote rDNS ends with mail-mail.facebook.com, just don't advertise STARTTLS" 'fix' is still very much in place, and probably will be indefinitely, even if that enables the entire Internet to eavesdrop on potentially-exciting stuff like login recovery tokens. And, yeah, the saddest part is that I could actually live-troubleshoot this issue with anyone at any time, providing PCAPs, updating the outgoing mail server behavior on demand, whatever. But that's just not the way the Internet (or, I guess, anything) works anymore, I'm afraid: 25 years-or-so ago I had, like, the pager number of the person running the national backbone, and we had many late-night conversations fixing subtle-but-annoying BGP/DNS/whatever issues, which was cool. These days? Being ignored is the best you can hope for, which goes back to my original point that everything is awful. Depressing, really...

by toast0 2y ago

toast0 2y ago

Oh yes, I forgot to tell you, facebook.com/whitehat is pretty good at escalating issues to the right team, but I don't know if someone would triage it and say it's not a security issue and then it has no urgency.

antithesis-nl 2y ago
> but I don't know if someone would triage it Well, I have a pretty good idea, and the answer won't comfort you. To further elaborate on this pointless saga: last December, I actually met a FB engineering executive while on holiday, happened to mention this issue in casual conversation (I know: sad!) and they were going to put me in touch with All The Right People who were going to Fix This Immediately. Guess what? The "oh, if the remote rDNS ends with mail-mail.facebook.com, just don't advertise STARTTLS" 'fix' is still very much in place, and probably will be indefinitely, even if that enables the entire Internet to eavesdrop on potentially-exciting stuff like login recovery tokens. And, yeah, the saddest part is that I could actually live-troubleshoot this issue with anyone at any time, providing PCAPs, updating the outgoing mail server behavior on demand, whatever. But that's just not the way the Internet (or, I guess, anything) works anymore, I'm afraid: 25 years-or-so ago I had, like, the pager number of the person running the national backbone, and we had many late-night conversations fixing subtle-but-annoying BGP/DNS/whatever issues, which was cool. These days? Being ignored is the best you can hope for, which goes back to my original point that everything is awful. Depressing, really...